Dev-only: manual mock-provider webhook to finalise an order.

It marks an order paid with no payment, so it only answers where settings.billing_mock_enabled is on (dev, e2e, staging); everywhere else it is a 404 like any unknown route. Even with the rail on it refuses orders of a rail whose merchant credentials are configured — those are paid only by the provider's signed callback. For dev / e2e tests, POST {"order_no": "ord_..."} to bump the order to 'paid' and trigger activate_subscription. Idempotent on the order_no — a duplicate callback is a no-op rather than a double-charge.